An adaptive machine learning framework for early detection of emerging cyber threats using network traffic analysis

The increasing dependence on internet-based services, cloud platforms and interconnected computing environments has created new challenges in maintaining network security. Cyberattacks are becoming more sophisticated, and their changing characteristics make conventional security mechanisms less effective against previously unidentified threats. Signature-based Intrusion Detection Systems (IDS) primarily recognize attacks using previously established patterns, which limits their ability to respond to unfamiliar and evolving malicious activities. This research proposes an adaptive machine learning framework for identifying potential cyber threats through continuous network traffic analysis. The framework combines supervised classification, anomaly identification and concept drift monitoring to recognize suspicious communication patterns. Random Forest and Extreme Gradient Boosting (XGBoost) are considered for traffic classification, while Isolation Forest is incorporated to identify unusual network behavior. An adaptive monitoring mechanism based on Adaptive Windowing (ADWIN) is proposed to recognize changes in incoming traffic patterns and initiate model updating when required. The proposed framework is designed to address the limitations of static detection models by supporting continuous adaptation to changing network conditions. Its performance will be investigated using publicly available cybersecurity datasets, including CIC-IDS2017 and UNSW-NB15. Evaluation will consider classification accuracy, precision, recall, F1-score, false-positive rate and detection time. The research aims to establish an adaptable and efficient intrusion detection approach that can support the identification of emerging cyber threats in dynamic network environments.